CVE-2026-9858: Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied orderid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxporderstatus action.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need to own or otherwise be authorized to access the targeted order.
What can an attacker do using the affected AJAX actions?
An attacker can read item details from arbitrary customer orders, including item names, quantities, and shipped counts. They can also alter shipped quantities and shipment status for any order, potentially causing order status transitions.
Are default authorization protections enforced for these actions?
No. The affected AJAX handlers lack capability checks and nonce verification, and they do not verify that the caller owns the supplied order_id.
How can I determine whether my site is affected?
Sites using Partial Shipment for Woocommerce version 3.4 or earlier are affected. The relevant AJAX actions are wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped.